@aarmos/cli 0.2.1 → 0.2.2

package/dist/index.js

@@ -55,6 +55,62 @@ var GITIGNORE_TEMPLATE = `# Aarmos local state
 .aarmos/keys/
 .aarmos/avar/
 `;
+var TEMPLATES = {
+  hello: {
+    description: "Minimal \u2014 policy + a single echo playbook. Great first run.",
+    files: {
+      "playbooks/hello.md": '# hello\n\nOne-step playbook. Ask the agent to echo a greeting.\n\n## steps\n\n1. Say: "hello from aarmos"\n',
+      "policy.aarmos.toml": `# hello template \u2014 deny-by-default, no external tools.
+[defaults]
+gates.destructive = "deny"
+rate.per_minute   = 30
+`
+    }
+  },
+  mcp: {
+    description: "MCP starter \u2014 one MCP adapter wired with a read-only scope.",
+    files: {
+      "policy.aarmos.toml": `# mcp template \u2014 one MCP adapter, read-only scope.
+[defaults]
+gates.destructive = "confirm"
+rate.per_minute   = 60
+
+[[adapters.mcp]]
+name   = "example"
+url    = "https://mcp.example.com/server"
+scopes = ["read:*"]
+`,
+      "playbooks/mcp-probe.md": "# mcp-probe\n\nList tools exposed by the configured MCP server and print their schemas. Read-only.\n"
+    }
+  },
+  policy: {
+    description: "ASP starter \u2014 YAML policy-as-code with a golden test.",
+    files: {
+      "asp.yaml": `# ASP \u2014 Agent Security Policy (draft)
+version: asp/1
+defaults:
+  gates:
+    destructive: confirm
+  rate:
+    per_minute: 60
+rules:
+  - id: deny-shell
+    when:
+      tool: "shell.*"
+    decision: deny
+    reason: "Shell tools are not permitted in this workspace."
+`,
+      "policies/tests/deny-shell.yaml": `# golden test \u2014 shell.* must be denied
+input:
+  tool: shell.exec
+  args: { cmd: "ls" }
+expect:
+  decision: deny
+  source: workspace-policy
+`
+    }
+  }
+};
 var IMPORT_ALLOWLIST = [
   "policy.aarmos.toml",
   "avar.config.json",
@@ -66,6 +122,9 @@ var IMPORT_ALLOWLIST = [
 ];
 function initCommand() {
   return new Command("init").description("Scaffold policy.aarmos.toml, avar.config.json, and local signing key").option("--force", "Overwrite existing files", false).option(
+    "--template <name>",
+    `Embedded starter template: ${Object.keys(TEMPLATES).join(" | ")}. Writes template files before defaults; existing files are preserved unless --force.`
+  ).option(
     "--from <repo>",
     "Seed policies/playbooks from a GitHub repo (owner/repo[#ref][/subdir]) or tarball URL. Only Aarmos config files are copied; source code and keys are never imported."
   ).action(async (opts) => {
@@ -74,6 +133,21 @@ function initCommand() {
     const chainDir = join(cwd, ".aarmos", "avar");
     mkdirSync(keyDir, { recursive: true });
     mkdirSync(chainDir, { recursive: true });
+    if (opts.template) {
+      const name = opts.template;
+      const tpl = TEMPLATES[name];
+      if (!tpl) {
+        console.error(
+          `\u2717 unknown template "${opts.template}". Known: ${Object.keys(TEMPLATES).join(", ")}`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      console.log(`\u25B8 template: ${name} \u2014 ${tpl.description}`);
+      for (const [rel, contents] of Object.entries(tpl.files)) {
+        writeIfMissing(join(cwd, rel), contents, opts.force);
+      }
+    }
     if (opts.from) {
       await seedFromRepo(opts.from, cwd, opts.force);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarmos/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Aarmos CLI — run any agent locally, across any protocol (MCP, OpenAPI, deep-link), with a signed AVAR receipt on every execution. Sovereign runtime, universal tool gateway, verifiable governance.",
   "keywords": [
     "aarmos",